// PRIVACY
Privacy, in plain language.
LAST UPDATED · September 2026
This page explains exactly what data guptaaviral.com collects, why, and what you can do about it. The short version: this site sets no analytics cookies and stores nothing on your device to measure traffic, which is why you were not asked to accept anything. The contact form goes straight to my inbox. Nothing is sold or shared with advertisers.
Who is responsible for this site?
guptaaviral.com is operated by Aviral Gupta, a full stack developer based in Dubai, United Arab Emirates. For anything privacy-related, email hello@guptaaviral.com or use the contact form. This policy is written to align with the EU GDPR and the UAE Personal Data Protection Law (PDPL), because visitors come from everywhere.
What data does this site collect?
The contact form
When you submit the contact form, I receive what you typed: your name, email, company, whether you are writing about a permanent role, a link, and your message. This data is used for exactly one thing — replying to you. It lives in my email inbox, is not added to any marketing list (I don't have one), and is deleted on request.
Analytics — cookieless, and why there is no banner
This site uses Plausible Analytics, which is hosted in the EU and operated by an EU company. It sets no cookies, writes nothing to localStorage or sessionStorage, and builds no device fingerprint. It records the page you viewed, the referring site, and a coarse country, browser and device type derived from your request and then discarded — never an identifier that follows you between sites or between visits. That is the reason you were not shown a cookie banner. German law (TDDDG § 25) requires consent to store or read information on your device, and this site does neither for analytics purposes, so there is nothing to consent to. The measurement itself rests on a legitimate interest under GDPR Art. 6(1)(f) — knowing which pages are read at aggregate level — and you can object to it at any time using the address below. Until 07.09.2026 this site ran Google Analytics 4 and Microsoft Clarity behind a consent banner. Both were removed. If you accepted that banner previously, those cookies expire on their own and you can delete them now.
Learning accounts (/learn)
If you create a free learning account, I store what the account needs to work: your name, email address, a one-way hash of your password (never the password itself), whether your email is confirmed, and the date you confirmed you are 16 or older. As you learn, your progress, answers, review schedule, focus sessions, notes and study-plan settings are stored against the account. Each sign-in also records the IP address and browser of that session, for security. To slow down password guessing and spam, requests to the account endpoints are counted per IP address in the same database; those counters are deleted after a day. The legal basis is Art. 6(1)(b) GDPR: this is the service you asked for, and it cannot save your progress without it. The data is held in a Postgres database run by Neon in Frankfurt, Germany, as a processor. Account emails (confirmation, password reset and organisation invitations) come from hello@guptaaviral.com through the same mail provider as the contact form. When you choose a password, the first five characters of its SHA-1 hash are checked against the public Have I Been Pwned breach list; neither the password nor anything identifying you is sent. You can download everything stored for your account as a JSON file, or delete the account permanently, from your account page at any time. Deletion removes every learning record immediately. Problem reports you sent about lesson content stay, without your name or email, because the correction still helps other learners. Accounts are for people aged 16 or older. How long: account data is kept while the account exists. Exit-check attempts that did not pass are deleted after 180 days, and practice answers after 365 days. Passed exit checks are kept while the account exists, because they are the record of how a certificate was earned and let a wrong answer key be traced to the certificates that relied on it; your progress, best scores and certificates are kept, because they are the summary of that history. Everything is deleted at once when you delete the account. Without an account, lessons still work: your progress, exit-ticket scores and notes are kept only in your own browser (local storage keys learn:v1 and learn:focus, the second holding your timer settings). Nothing from them is sent to me, and clearing your browser data removes them. The code editors in course lessons and project guides work the same way for everyone, with or without an account: the code you write, and whether its self-checks last passed, are kept only in your browser (local storage keys starting with learn:practice:), so a draft survives a reload. Your code runs in your browser, in an isolated frame that has no access to this site, its cookies or its storage. Nothing of it is sent to me, and it never counts toward progress or a certificate. The Python runtime it needs is downloaded from this site, not from a third party, only when you first run code. Anyone can use “Report a problem” on a lesson. A report stores the category, your message, the lesson or question it is about, the page address, the site version and, only if you enter one, your email address, and it is emailed to me. The legal basis is Art. 6(1)(f) GDPR, the legitimate interest in correcting the content; the email address is used only to reply. The same Cloudflare Turnstile check as on the contact form protects it against spam.
Organisations and learner groups (/learn)
An organisation on /learn is set up by the site owner; learners cannot create one. If an organisation’s administrator invites you, I store the invitation: your email address, the role offered, who sent it, and when it expires (7 days). The invitation email comes from hello@guptaaviral.com. You decide whether to accept; declining or ignoring it changes nothing on your account. Invitations are deleted 30 days after they expire, whether they were answered or not. If you accept, your membership (organisation, role, date) and the groups you are added to are stored. The organisation’s instructors and administrators then see, only for the tracks assigned to your group: whether you have started or completed each track and when, whether you earned its certificate and when, your best exit-check score per lesson, and your focus minutes on those lessons. They never see your notes, your individual answers, your drift log or your attempt history, or anything about lessons not assigned to your group. Administrators also see your name, email address and role in the member list, because they manage who belongs to the organisation. The legal basis is Art. 6(1)(b) GDPR: showing your progress on assigned lessons to the organisation you chose to join is the service you joined it for, and the invitation page says exactly what is shown before you accept. For the invitation itself, before you have an account relationship with the organisation, it is Art. 6(1)(f) GDPR, the organisation’s and my legitimate interest in letting you know you were invited. You can leave an organisation at any time from its page; its instructors lose access to your progress at once, and your own progress stays with your account. Being removed by an administrator, or deleting your account, has the same effect.
Certificates of completion
When you pass the exit check of every lesson in a track, your account receives a certificate of completion: the track, its content version, the date, and the name you confirm for it. It is private: only you see it, on your certificates page, until you decide otherwise. The legal basis for issuing and keeping it is Art. 6(1)(b) GDPR, as part of the learning account. Publishing is a separate choice, based on your consent (Art. 6(1)(a) GDPR). If you publish a certificate, a page at its own link shows the name you confirmed, the lessons completed, the issue date, the content version, the issuer and whether it is valid; and, only if you choose to, an organisation you belong to. Nothing else is shown: no email, no scores, no attempts, no time spent. The consent text and its version are stored with the date you published. You can withdraw consent at any time with one click (“Unpublish”), as easily as you gave it; the page then stops existing at once. Withdrawal does not affect anything that was lawful before it. A published page is not listed by search engines unless you also switch that on, as a second, separate choice. Only then may it appear in search results and in this site’s sitemap; switching it off, or unpublishing, removes it from the sitemap within an hour, and search engines drop it once they see the page is gone. Certificates, published or not, are kept while your account exists and deleted with it. If a certificate is revoked (for example because it was obtained by misuse), it is kept and marked as revoked, with the reason, so that a check of its link gives a true answer; revocation is done only by the site owner, never by an organisation. You can still unpublish a revoked certificate; its page then stops existing like any other.
Server logs & security
This site is hosted by Vercel Inc. (United States) and served from its edge network. Vercel processes technical data — IP address, browser, request time — to deliver pages and keep the service secure, as a processor under a data processing agreement, with the transfer safeguards set out in that agreement. The legal basis is Art. 6(1)(f) GDPR: the legitimate interest in running a secure, working website. Spam protection is Cloudflare Turnstile. It runs on the contact form and, in the learning section, on sign-up, password reset, resending the confirmation email, invitations and problem reports; it does not track you across the web. Logs are retained briefly, for security purposes, and are not used to build a profile of you.
What cookies does this site use?
Three, all functional, all set only in response to something you did. None of them measure you and none are set on a first visit:
NEXT_LOCALE
Remembers your language choice (English or Deutsch) so the site doesn't keep asking. Set only when you switch language. Expires in 1 year.
NEXT_GEO_DISMISS
Remembers that you dismissed the language suggestion, so it is not shown again. Set only when you dismiss it. Expires in 1 year.
better-auth.session_token
Keeps you signed in to your learning account. Set only when you sign in, and only on /learn features; visitors who never sign in never receive it. HTTP-only, so no script can read it. On the live site the browser shows it with a __Secure- prefix. Expires after 30 days without a visit, or when you sign out.
All three carry a choice you made, or the fact that you signed in, and no identifier that follows you anywhere else. Because each is strictly necessary for something you asked for, none needs a consent banner (TDDDG § 25(2) No. 2). There are no analytics cookies, no advertising cookies and no third-party cookies, because there are no advertising or analytics tags on this site to set them.
What are your rights?
- Ask what data I hold about you — you'll get a straight answer, usually the same day.
- Ask for a copy of it.
- Ask for it to be corrected or deleted — one email is enough.
- Object to the aggregate traffic measurement described above, under GDPR Art. 21. There is no cookie to clear and no setting to find: email me and I will exclude you.
- Complain to your data-protection authority — though I'd rather you email me first so I can fix it.
Requests: hello@guptaaviral.com. No forms, no ticket systems, no 30-day waiting games.
Does this site share or sell data?
No. Data from the contact form is never sold, rented, or shared with third parties. The only processors involved are infrastructure providers necessary to run the site (hosting, email delivery, spam protection), each bound by their own data-processing terms. There are no marketing tools, no CRM pipelines, no lead-scoring robots. Your message goes to a person.
What about AI crawlers and this site?
A note in the spirit of transparency: this site explicitly allows major AI crawlers (see robots.txt) so AI assistants can accurately describe this site and its author. This concerns the site's public content — your personal data is never exposed to crawlers, and form submissions are transmitted over TLS and never published.
Changes & contact
If this policy changes, the date at the top changes with it, and material changes are described here in the same plain language. Questions, requests, or corrections: hello@guptaaviral.com · +971 52 224 7789 · Dubai, UAE.